GNS3 Network Sec

TRIỂN KHAI DMZ VỚI CISCO ASA FIREWALL

Mục tiêu

  • Triển khai kiến trúc DMZ sử dụng Cisco ASA Firewall
  • Hiểu Security Levels và Security Policies trên ASA
  • Cấu hình Access Rules, NAT, và Object Groups

Topology: Theo tô-pô bài pfSensen -Bài 2: Cấu hình DMZ với pfSense trên GNS3

BƯỚC 1: CẤU HÌNH CƠ BẢN ASA

1.1. Cấu hình Interfaces và Security Levels

ASA> enable
ASA# configure terminal

! Cấu hình Outside Interface
ASA(config)# interface GigabitEthernet0/0
ASA(config-if)# nameif outside
ASA(config-if)# security-level 0
ASA(config-if)# ip address 192.168.122.254 255.255.255.0
ASA(config-if)# no shutdown

! Cấu hình Inside Interface
ASA(config)# interface GigabitEthernet0/1
ASA(config-if)# nameif inside
ASA(config-if)# security-level 100
ASA(config-if)# ip address 192.168.1.1 255.255.255.0
ASA(config-if)# no shutdown

! Cấu hình DMZ Interface
ASA(config)# interface GigabitEthernet0/2
ASA(config-if)# nameif dmz
ASA(config-if)# security-level 50
ASA(config-if)# ip address 172.16.1.1 255.255.255.0
ASA(config-if)# no shutdown

1.2. Giải thích Security Levels:

  • Outside: Security Level 0 (Untrusted)
  • DMZ: Security Level 50 (Semi-Trusted)
  • Inside: Security Level 100 (Trusted)

Mặc định ASA cho phép:

  • High → Low Security Level (Inside → DMZ/Outside)
  • Không cho phép: Low → High Security Level

BƯỚC 2: CẤU HÌNH ACCESS RULES

2.1. Access Rules cho Outside Interface

! Cho phép Internet vào DMZ Web Server
ASA(config)# access-list outside_in extended permit tcp any host 172.16.1.200 eq www
ASA(config)# access-list outside_in extended permit tcp any host 172.16.1.200 eq https
ASA(config)# access-list outside_in extended permit icmp any host 172.16.1.200

! Chặn Internet vào Inside
ASA(config)# access-list outside_in extended deny ip any 192.168.1.0 255.255.255.0

! Áp dụng ACL trên Outside Interface
ASA(config)# access-group outside_in in interface outside

2.2. Access Rules cho DMZ Interface

! CHẶN DMZ vào Inside (quan trọng!)
ASA(config)# access-list dmz_in extended deny ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0

! Cho phép DMZ ra Internet
ASA(config)# access-list dmz_in extended permit ip 172.16.1.0 255.255.255.0 any

! Áp dụng ACL trên DMZ Interface
ASA(config)# access-group dmz_in in interface dmz

2.3. Access Rules cho Inside Interface

! Cho phép Inside ra mọi nơi (mặc định đã được phép từ high to low)
! Nhưng cần explicit rule để ghi log
ASA(config)# access-list inside_in extended permit ip 192.168.1.0 255.255.255.0 any
ASA(config)# access-group inside_in in interface inside

BƯỚC 3: CẤU HÌNH NAT

3.1. NAT cho Inside Network (PAT)

! Inside ra Internet - NAT Overload
ASA(config)# object network INSIDE_NET
ASA(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA(config-network-object)# nat (inside,outside) dynamic interface
ASA(config-network-object)# exit

3.2. NAT cho DMZ Network (PAT)

! DMZ ra Internet - NAT Overload
ASA(config)# object network DMZ_NET
ASA(config-network-object)# subnet 172.16.1.0 255.255.255.0
ASA(config-network-object)# nat (dmz,outside) dynamic interface
ASA(config-network-object)# exit

3.3. Static NAT cho Web Server

! Public IP cho Web Server
ASA(config)# object network WEB_SERVER
ASA(config-network-object)# host 172.16.1.200
ASA(config-network-object)# nat (dmz,outside) static 192.168.122.200
ASA(config-network-object)# exit

BƯỚC 4: CẤU HÌNH OBJECT GROUPS (NÂNG CAO)

4.1. Tạo Object Groups cho quản lý dễ dàng

! Network Object Groups
ASA(config)# object-group network INSIDE_HOSTS
ASA(config-network-object-group)# network-object 192.168.1.0 255.255.255.0
ASA(config-network-object-group)# exit

ASA(config)# object-group network DMZ_SERVERS
ASA(config-network-object-group)# network-object host 172.16.1.200
ASA(config-network-object-group)# network-object host 172.16.1.201
ASA(config-network-object-group)# exit

! Service Object Groups
ASA(config)# object-group service WEB_SERVICES tcp
ASA(config-service-object-group)# port-object eq www
ASA(config-service-object-group)# port-object eq https
ASA(config-service-object-group)# exit

4.2. Sử dụng Object Groups trong ACL

! Sửa ACL Outside với Object Groups
ASA(config)# access-list outside_in extended permit tcp any object-group DMZ_SERVERS object-group WEB_SERVICES
ASA(config)# access-list outside_in extended permit icmp any object-group DMZ_SERVERS

BƯỚC 5: CẤU HÌNH ROUTING

5.1. Default Route ra Internet

ASA(config)# route outside 0.0.0.0 0.0.0.0 192.168.122.1

BƯỚC 6: KIỂM TRA VÀ TEST

6.1. Test Kết Nối Cơ Bản

# Từ Inside (192.168.1.10)
ASA# ping inside 192.168.1.10
ASA# ping inside 172.16.1.200

# Từ DMZ (172.16.1.200) 
ASA# ping dmz 172.16.1.200
ASA# ping dmz 192.168.122.1

# Từ Outside (192.168.122.33)
ASA# ping outside 172.16.1.200

6.2. Kiểm Tra Firewall Rules

# Hiển thị Access Lists
ASA# show access-list

# Hiển thị NAT Rules
ASA# show nat

# Hiển thị Connections
ASA# show conn

# Hiển thị Interface Status
ASA# show interface ip brief

6.3. Test End-to-End

# Test 1: Inside → DMZ (Nên thành công)
PC1> ping 172.16.1.200

# Test 2: Inside → Outside (Nên thành công)
PC1> ping 192.168.122.33

# Test 3: Outside → DMZ Web (Nên thành công)
PC3> telnet 192.168.122.200 80

# Test 4: Outside → Inside (Nên bị chặn)
PC3> ping 192.168.1.10

# Test 5: DMZ → Inside (Nên bị chặn)
Web-Server> ping 192.168.1.10

# Test 6: DMZ → Outside (Nên thành công)
Web-Server> ping 192.168.122.33

BƯỚC 7: MONITORING VÀ LOGGING

7.1. Bật Logging cho ACL

! Bật logging cho các rule quan trọng
ASA(config)# access-list outside_in extended permit tcp any object-group DMZ_SERVERS object-group WEB_SERVICES log
ASA(config)# access-list dmz_in extended deny ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0 log

7.2. Kiểm Tra Logs

# Xem real-time logs
ASA# show log

# Xem connection events
ASA# show log | include Deny
ASA# show log | include Built

CẤU HÌNH HOÀN CHỈNH

! Interfaces và Security Levels
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 192.168.122.254 255.255.255.0

interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0

interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0

! Access Rules
access-list outside_in extended permit tcp any host 172.16.1.200 eq www
access-list outside_in extended permit tcp any host 172.16.1.200 eq https
access-list outside_in extended permit icmp any host 172.16.1.200
access-list outside_in extended deny ip any 192.168.1.0 255.255.255.0
access-group outside_in in interface outside

access-list dmz_in extended deny ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list dmz_in extended permit ip 172.16.1.0 255.255.255.0 any
access-group dmz_in in interface dmz

access-list inside_in extended permit ip 192.168.1.0 255.255.255.0 any
access-group inside_in in interface inside

! NAT Configuration
object network INSIDE_NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

object network DMZ_NET
 subnet 172.16.1.0 255.255.255.0
 nat (dmz,outside) dynamic interface

object network WEB_SERVER
 host 172.16.1.200
 nat (dmz,outside) static 192.168.122.200

! Routing
route outside 0.0.0.0 0.0.0.0 192.168.122.1

Comments are closed.

MENU